I just found out something weird. I logged into my Linux machine on the account “ender”…on two passwords

Question

Both passwords work!~!! how????

I'm using latest ubuntu version.

Do you see something in /var/log/auth.log about both of them? What does it say?
What is account 'ender' ? What were the two passwords (if we can know) -- otherwise, how different are they, what are the md5 like? From where did you log on (tty, vty, sty, su, su - .... ) ? What's the line like in /etc/shadow ?
Ender has sudoer ALL. I logged in from Putty, simple. The line is like this (with letters changed) .... ender:7.P22C5bQli72:14549:0:99999:7:::
So you logged in via SSH ? What kind of authentication scheme are you using for SSH ? Maybe it allows incoming connections from your username at your local IP ? SSH authentication isn't a topic I know very well, I prefer locking it down more than opening it up.

Jon Lasser · Answer 1 · 2010-02-04 20:40:28Z

up vote 10 down vote accepted

Are both passwords more than 8 characters long? Some password backends respect only the first 8 characters of a password...

answered Feb 4 '10 at 20:40

	I'd completely forgotten about that! I wonder if Ubuntu's SSH server is old enough to fizzle there. – Trevoke Feb 4 '10 at 20:43
	It is not the SSH server but rather the hash function used. – grawity Feb 4 '10 at 21:10
	Yes,they're both more than 8 characters, and they both start with the same 8 characters. – Alex Feb 4 '10 at 21:17
	Wow, you're right. I tried other passwords that start with the same 8 chars, and it works. – Alex Feb 4 '10 at 21:18
	Hah. I did that once with Solaris...I thought I was being SO secure, and it turned out that my hilariously long 32 character password was only 8 characters long. – Satanicpuppy Feb 4 '10 at 22:12

feedback

migrated from stackoverflow.com Feb 4 '10 at 20:16